Komodia SSL certificates are in many products
marcrogers.org
marcrogers.org
more information here http://blog.erratasec.com/2015/02/extracting-superfish-certi...
Komodia is a company that makes an SSL hijacking product, as described on their site:
Our advanced SSL hijacker SDK is a brand new technology that allows you to
access data that was encrypted using SSL and perform on the fly SSL
decryption. The hijacker uses Komodia’s Redirector platform to allow you
easy access to the data and the ability to modify, redirect, block, and
record the data without triggering the target browser’s certification
warning. [1]
Any website protected by SSL where that SSL authority isn't pinned by chrome (do other browsers have such tech?) is now trivially vulnerable to SSL hijacking by, eg, anyone in the same coffee shop or local network. And, of course, between that user and their destination site.
The current kerfuffle is due to the fact that Lenovo was caught pre-installing Superfish, an adware/spyware product -- for the users benefit! -- that, in turn, installed the Komodia ssl hijacking toolkit and broke SSL on any such infected computer.
The race is now on for every goddamn script kiddie in the entire world to the bank accounts of any suckers that trusted Lenovo. Go up to Seattle where windows laptops are more common, roll into a coffee shop, and I bet you can earn yourself some bank account logins.
ps -- this is a reason people buy macs. You get a vanilla OS install; that's currently only really available for Windows afaik from the Microsoft store.
In comparison, installing Ubuntu is a breeze, almost all the drivers you need are included with the install media and installed automatically, etc. Unless you have brand new, just-released hardware, it "just works", and even with brand new hardware there tend to be guides on the internet that are still easier than getting drivers installed on Windows.
Actual thing that happened: My mom said she needed to reformat an old laptop but didn't have the Windows media and wondered what to do. On a lark I suggested installing Ubuntu. A few weeks later, having not heard anything, I asked what happened to the laptop. She said she installed Ubuntu and it worked great. Never asked me a single question.
Not just the drivers, but pretty much everything I need for a new Linux system is available through apt. For windows, one must go to a dozen websites, download packages, and click next 10 times in each idiosyncratic install "wizard".
I had a similar experience with my mother, as well – I was constantly having to intervene with tech-support before I installed Ubuntu on her machine.
That's because it is. Windows: do nothing, it's already installed. Linux: you have to install.
People compare what they have to do to get Windows on a new machine, which almost always (unless it's an Apple) already has it installed, with what they have to do to get Linux on a new machine, which almost always requires it to be installed. Even the simplest installer will be more difficult than "nothing".
If computers didn't come with any preinstalled operating system, the general opinion would be different.
(That said, most of the "Linux is difficult to install" sentiment is probably either based on outdated information from the time when you had to manually configure everything, or someone who had difficulties because of unsupported or poorly supported hardware.)
I'm more thinking about setting up a new system. Whether it's Windows or Linux, I need to obtain things like an FTP program, a photo editor, a torrent manager, firefox, and so forth. It's a lot easier on Debian than Windows because you can get all of those in 5 minutes from the command line.
Though I was installing from an MSDN install DVD which isn't something everybody would have on hand.
EDIT: I had the OEM Product Key on the Sony and AW, and they both registered fine without a problem, no need for pirated versions or any taxes.
1) Windows Update can't help you install your network driver. :)
2) My experience is that only some drivers were available through Windows Update, while others were not.
http://www.microsoft.com/en-us/download/windows-usb-dvd-down...
How should the UEFI cause the piracy warning to be displayed? Much more likely: Those people got their 'other' installation medium from ~somewhere~ and the activation failed.
Booh for Lenovo's actions and a crappy recovery medium, but I highly doubt that _this_ is actually more than FUD.
For most of us hacker news reader, it's nothing out of the ordinary. It can be a little bumpy once in a while (UEFI sometimes) and it's usually faster to simply take 30 minutes to uninstall the crapware.
Personnally I start by imaging the hard drive, then I wipe ip and install whatever is required at the time usually a gnu/linux flavor or a windows 7.
For most people, it's not going to happen without help.
This does sound like a good argument for wiping the OEM windows 7 pro partition on my laptop, and install a windows 10 trial or something (I currently just run Debian GNU/Linux on it -- but it's technically dual-boot).
So I installed a pirated Windows.
The easy option is to phone microsoft support and explain the problem, you most probably will be given a new valid key. Other options for techies includes using OEM install medium or installing a free software OS.
Nowadays there's no licence key to type anymore, it's included in the hardware sold with windows 8 (which is worse).
Edit: LOL, ok so the keys are right there on that link. Nice!
Barak Weichselbaum founded Komodia, Inc. in 2000, following his military service as a programmer in the IDF’s Intelligence Core.
But you don't need to worry about provenance to see that technically this is a scary thing to do.
It usually works.
Consription in the IDF’s Intelligence Core doesn't
You laughed out loud? That's good. You should tell Barak that, I just pasted his own statement:
--- http://www.komodia.com/about/
Barak Weichselbaum founded Komodia, Inc. in 2000, following his military service as a programmer in the IDF’s Intelligence Core.
---
Phhh, more likely an attempt at controlling knowledge of the "Intelligence Core"!
If this guy had been in a part of the US military (all volunteer, which shows disposition) that frequently gets loaned out to the CIA or NSA (Force recon, Delta, Seals, etc) then the concern would be reasonable, but that isn't the case here.
Catholicism doesn't allow for condoms. Most Irish are catholic. Therefor most Irish don't use condoms.
The logic isn't sound. The conclusion might be true (I know nothing about Irish birth control), but the statement can't be logically proven given the proceeding input.
The military spies. Most citizens are required to be in the military. Therefor most citizens are spies.
Again, the logic doesn't follow and is obviously flawed.
As we all know thanks to Edward Snowden, there are many Powerpoint Rangers in the military invading privacy, operating lethal drones, and killing people from their flying desks.
My point is that you don't have to be in an elite group info sec pros to menace people's privacy and security.
You claimed that "these are the same people that monitor cctv feeds of border fences - it isn't some elite unit of super hackers.", so even if you don't consider those tasks of much importance, and even if they're not some elite unit of super hacker, that doesn't cancel out the fact that they're menacing to everyone's privacy and security that they're invading.
Komodia’s “Keep My Family Secure” parental control software.
Qustodio’s parental control software
Kurupira Webfilter
Lenovo did not vet the software properly before bundling it and heads should roll, but I do not think they are deliberately evil or malicious.
If Lenovo are to be condemned, then the entire open-source community must also condemn itself for allowing OpenSSL and Bash to have remained vulnerable for so long. Just like Lenovo, our eyes were wide shut, and it took a shock to open them.
Just because Lenovo didn't build the software, doesn't mean they are not guilty of overlooking a serious security vulnerability by including software which provides no benefit to its customers. It's an insult to customers.
The bugs you find in openSSL and Bash are not insults, they are mistakes made by people who don't get money out of their work (and who don't go out of their way to sell / track information). Security is hard to build correctly, easy to break.
The fundamental problem is that software like this greatly increases your attack surface, and thus should only be used with careful consideration if the benefits are worthwhile. Instead, Lenovo put its users at risk without informing them or providing them with any benefit.
https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf...
Before that I used Burpsuite, but that uses its own self signed cert too.
Privoxy doesn't do SSL or did I miss something?
They did put their customers up to harm, for no other reason then trying to squeeze another buck out of them. They provide no additional benefit to the customer.
OpenSSL and Bash are free services providing benefit to their users.
Komodia is to blame for making the software they make and the way they do it.
Open-source is irrelevant to this matter, but if anything the tech community is to blame for telling the world that the lock in the browser and https means the connection is secure.
(S)he picked incompetent:
> Lenovo did not vet the software properly before bundling it and heads should roll, but I do not think they are deliberately evil or malicious.